The present invention relates to computer programs for detecting malicious programs such as spyware and the like.
Malicious programs or “malware” have become a significant problem in the computer industry. Examples of such malware include: “viruses” which are programs attached to documents or other programs and that activate themselves within a host computer to self-replicate for further spreading; “worms” which are programs that self-replicate to transmit themselves across a network; “Trojans” or “Trojan horses” which are programs that masquerade as useful programs but contain portions to attack the host computer or leak data; “back doors” which are programs that open a system to external entities by subverting local security measures; and “spyware” which are programs that transmit private-user data to an external entity. More generally malware is malicious software intentionally included or inserted in a system for a harmful purpose.
Spyware, in particular, has become a significant security threat. Some studies have suggested that as many as 69% of the computers connected to the Internet have been infected with spyware at some point in time. The damages caused by spyware (e.g. stolen credit card numbers) are not limited to disruption of the infected computer system, yet unlike some other types of malware, spyware may not noticeably degrade the performance of the computer.
Methods for detecting malicious programs may be classified as dynamic or static. In dynamic methods, the suspected program is executed in a “sandbox”. A sandbox is a safe execution area created in a computer that uses hardware and/or software to prevent the executing program from damaging interaction with the computer. During execution of the malware in the sandbox, attempts by the malware to interact with the computer, such as by writing data outside of a predefined memory area, are monitored. The constraints placed on the sandbox make it an impractical environment for the execution of normal programs, and this technique is normally used off-line for research purposes.
Static detection does not require execution of the suspected program, but instead reads and analyzes the program instructions or “code” before it is executed. One “heuristic” detection technique looks for changes in certain program locations (normally the beginning and end of the code) where the virus is likely to be attached. A second “signature” detection technique checks for known virus-specific sequences of instructions (virus signatures) inside the program. Such signature detection is effective when the virus does not change significantly over time and when multiple viruses have the same signature.
Most malware detection and prevention systems intended for real-time defense of an operating computer use a signature detection system performing a background scanning of files to detect signatures of known malware. This signature-based solution has two major shortcomings. First it is ineffective against novel malware for which no signature has been developed. Second, it is ineffective against known malware that has been modified with minor changes (“obfuscation)” which can defeat the signature scanning technique.